CN104937895B - The method and apparatus for controlling access in a wireless communication system - Google Patents
The method and apparatus for controlling access in a wireless communication system Download PDFInfo
- Publication number
- CN104937895B CN104937895B CN201480005392.9A CN201480005392A CN104937895B CN 104937895 B CN104937895 B CN 104937895B CN 201480005392 A CN201480005392 A CN 201480005392A CN 104937895 B CN104937895 B CN 104937895B
- Authority
- CN
- China
- Prior art keywords
- server
- object instance
- servers
- access control
- access
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
- H04W12/082—Access security using revocation of authorisation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0803—Configuration setting
- H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/50—Service provisioning or reconfiguring
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Storage Device Security (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
A kind of method that the particular object instance associated with server is handled due to server account deletion in a wireless communication system is provided, wherein, method is performed and comprised the following steps by terminal:The operational order for the account for being used to delete particular server is received from first server;When particular object instance is the object instance that can be only accessed by particular server, particular object instance and the access control object instance associated with particular object instance are deleted;When particular object instance be can be by the object instance of multiple server access including particular server when, from the access control object instance associated with particular object instance delete particular server access mandate information;And when particular server is unique access control owner of access control object instance, the server of the highest sum with the value for distributing to each access rights among multiple servers in addition to particular server is changed into the access control owner.
Description
Technical field
The present invention relates to the method and its equipment for controlling access in a wireless communication system.
Background technology
M2M (Machine To Machine) communication technologys have attracted attention with the arrival in pervasive epoch.M2M can be used for such as
The various applications of electronic health care, intelligent grid, wired home etc..In such an application, having used has various hardware specifications
M2M devices and can to receive the agreements of any kind of M2M devices be desirable.It is suitable for providing therefore, it is necessary to develop
Source is limited the application layer protocol of M2M devices.Such agreement is suitable for resource-constrained M2M devices, and then can also be applied to tool
There are the M2M devices of different specification.
Meanwhile M2M devices need access control technology.Specifically, when delete to M2M client registers M2M service
During device account, it is necessary to handle the deletion of M2M servers account and the resource associated with the M2M servers to be deleted.According to
M2M servers account is deleted, and specific resources can be the resource that access rights are not present or can be with Do away with the management for M2M visitors
The M2M servers of the access rights of resource in the end of family.Therefore, it is desirable to this solution.
The content of the invention
Technical problem
The present invention provides a kind of method for access control.
More particularly it is an object to provide one kind processing when deleting particular server account is specific with this
The method for the resource that server account is associated.
Another object of the present invention is to provide a kind of method being authenticated to notice.
Another object of the present invention is to provide a kind of method of the access module of setting terminal.
By present invention solves the technical problem that be not limited to above-mentioned technical problem, and those skilled in the art can according to
It is lower to describe to understand other technical problems.
Technical solution
According to an aspect of the present invention, it is a kind of by terminal in a wireless communication system due to server account deletion
And the method for handling the particular object instance associated with server comprises the following steps:Received from first server and be used to delete
The operational order of the account of particular server;When the particular object instance is the object that can only be accessed by the particular server
The particular object instance and the access control object instance associated with the particular object instance are deleted during example;When described
Particular object instance is when can be by the object instance of multiple server access including the particular server, from it is described specific
The access authority information of the particular server is deleted in the access control object instance that object instance is associated;And work as
When the particular server is unique access control owner of the access control object instance, it will come from and remove the specific clothes
The server of the highest sum with the value for distributing to each access rights among the multiple server outside business device changes
For the access control owner of the access control object instance.
Addition or alternatively, the change may comprise steps of:As there is the highest sum with described value two
Or more server when, select one in the two or more servers, and selected server is changed
For the access control owner.
Addition or alternatively, the institute that the account of the particular server can be deleted by guiding interface to be used for
State operational order.
Addition or alternatively, the first server can be Boot Server.
Addition or alternatively, the method can also comprise the following steps:If it is described by the second server
The access control owner of access control object instance sets " observation " operation, then is sent to second server and be directed to institute
State the notice of change of the access control owner when the access control owner is changed.
Addition or alternatively, the method can also comprise the following steps:Delete by being sent from the particular server
" observation " operational order storage the configuration information related with " observation " operational order.
Addition or alternatively, the account of the particular server can include the short server of the particular server
ID and the safe key for communicating with the particular server.
According to another aspect of the present invention, it is a kind of to be configured as in a wireless communication system since the account of server is deleted
The terminal removed and handle the particular object instance associated with server includes:Radio frequency (RF) unit;And processor, the processing
Device is configured as controlling the RF units, wherein, the processor is configured as:Received from first server specific for deleting
The operational order of the account of server;When the particular object instance is the object instance that can only be accessed by the particular server
When, delete the particular object instance and the access control object instance associated with the particular object instance;As the spy
Determining object instance is when can be by the object instance of multiple server access including the particular server, from it is described specific right
Access authority information as deleting the particular server in the access control object instance that example is associated;And work as institute
When to state particular server be unique access control owner of the access control object instance, it will come from and remove the special services
The server of the peak with the value for distributing to each access rights among the multiple server outside device is changed into
The access control owner of the access control example.
Addition or alternatively, the processor, which can be configured as, has two of highest sum with described value or more
During multiple servers, one in the two or more servers is selected, and is configured to change selected server
It is changed into the access control owner.
Addition or alternatively, the institute that the account of the particular server can be deleted by guiding interface to be used for
State operational order.
Addition or alternatively, the first server can be Boot Server.
Addition or alternatively, if being the access control of the access control object instance by the second server
The owner processed sets " observation " operation, then the processor, which can be configured as to send to second server, is directed to the access
Control the notice of change of the owner when the access control owner is changed.
Addition or alternatively, the processor can be configured as to delete and " be seen by what is sent from the particular server
The configuration information related with " observation " operational order of survey " operational order storage.
Addition or alternatively, the account of the particular server can include the short server of the particular server
ID and the safe key for communicating with the particular server.
Preceding solution is only the part of embodiments of the present invention, and the technology for wherein reflecting the present invention is special
The various embodiments of sign can be obtained and understood based on the described in detail below of the present invention by those skilled in the art.
Beneficial effect
According to the embodiment of the present invention, efficient resource management can be promoted.
According to the embodiment of the present invention, can make it possible to realize efficient notification in response to observation.
According to the embodiment of the present invention, it is capable of the power of efficiently management terminal.
The effect of the present invention is not limited to effect described above, and according to being described below, do not describe herein its
Its effect will become obvious to those skilled in the art.
Brief description of the drawings
Attached drawing be included to provide a further understanding of the present invention, attached drawing exemplified with embodiments of the present invention, and
With being used for illustrating the principle of the present invention together with this specification.In attached drawing:
Structures of the Fig. 1 exemplified with the data being stored in M2M clients;
Fig. 2 is exemplified with resource model according to the embodiment of the present invention;
Fig. 3 is exemplified with interface model according to the embodiment of the present invention;
Fig. 4 is operated exemplified with guiding according to the embodiment of the present invention;
Fig. 5 is operated exemplified with guiding according to the embodiment of the present invention;
Fig. 6 registers operation exemplified with observation according to the embodiment of the present invention;
Fig. 7 is operated exemplified with the report (notice) in response to observation according to the embodiment of the present invention;
Examples of the Fig. 8 exemplified with observation according to the embodiment of the present invention and registration and the report responsed to which;
Operations of the Fig. 9 exemplified with the change access rights owner according to the embodiment of the present invention;And
Figure 10 is the block diagram for the equipment for being used for realization embodiments of the present invention.
Embodiment
Now with reference to attached drawing in detail with reference to the illustrative embodiments of the present invention.By what is provided below in reference to attached drawing
The illustrative embodiments for being intended to illustrate invention are described in detail, rather than are intended to show that what can only be realized according to the present invention
Only embodiment.It is described in detail below including specific detail in order to provide thorough understanding of the present invention.However, for ability
For field technique personnel it is evident that, the present invention can be put into practice without these specific details.
In some cases, the design of the present invention obscures in order to prevent, and the structure and equipment of known technology will be omitted, or
Major function based on each structure and equipment is shown in block diagram form.Also, as possible, identical attached drawing mark
Note will be used to refer in all attached drawings and this specification for same or similar part.
In the present invention, the device (that is, M2M clients or terminal) for M2M communication can be fixed or move
And including the server for M2M communication, i.e. M2M servers are communicated with server with transmission/reception user data
And/or the device of control information.M2M clients can be referred to as terminal device, MS (movement station), MT (mobile terminal), UT and (use
Family terminal), SS (subscriber station), wireless device, PDA (personal digital assistant), radio modem, hand-held device etc..In addition,
M2M servers refer to the fixed station that communicates with M2M terminals and/or other M2M servers and by with M2M terminals and/
Or other M2M servers are communicated to exchange data and control information.
The description to the prior art will be provided.
Device management
Device management refer to device device configuration and other managed objects from the pipe from the point of view of various administrative authorities
Reason.Device management including but not limited to set in a device initial configuration information, permanent information in device follow-up renewal, from
The event and alarm of searching, managing information and processing by device generation in device.
Management tree
Management tree refer to management server for example by store the value in management tree in or from management set in searching value and
By the attribute (for example, accesses control list) of handle management tree come the interface that is interacted with client.In the present specification, term
Management tree can convertibly use with term device management tree or DM trees.
Manage object (MO)
Management object is management tree it is intended that node (may the be unit collection) intersection connected in some way
Subtree.For example./DevInfo nodes form management object.Simple management object can be made of individual node.
Device management (DM) server
DM servers can meet the OMA devices specified for DM servers in the device management infrastructure of deployment
Manage the abstraction component of enabler static conformance requirements.DM servers are used as the endpoint of DM Client-Server Protocols
With DM server-server interfaces.
In the present specification, can be installed on DM servers includes the device of communication module, processor module etc., calculates
In machine etc..
Device management (DM) client
DM clients can meet the OMA device management enablers specified for DM clients in device embodiments
The abstraction component of static conformance requirements.DM clients are used as the endpoint of DM Client-Server Protocols.
In the present specification, DM clients can be installed on the communication module for including the object as DM, processor die
In the device of block etc..DM clients can be implemented as single assembly.
Accesses control list (ACL)
ACL refers to the DM identifier servers of the specific node in being set in relation to management and the visit associated with each identifier
Ask the list of authority.
Node
Node is the individual element in management tree.There may be two kinds of nodes in management is set:Internal node and leaf node.
The attribute of a configuration of node provide on the node be leaf node or internal node information.
Internal node
Internal node is that can have the node of child node, but can not store any value (that is, the section for distributing to node
Point value).The attribute of a configuration of internal node is " node ".
Leaf node
Leaf node can memory node value, but can not have child node.The attribute of a configuration of leaf node is not " node ".
Therefore, all father nodes must be internal node.
Persistent node
If DDF range of attributes is arranged to permanent, persistent node is permanent.If node is not permanent,
Then the node corresponds to dynamic node.Persistent node can not be dynamically generated or be deleted by server.
Dynamic node
If DDF range of attributes is arranged to dynamic or if range attribute is not specified, dynamic node is dynamic
's.
Identifier server
Identifier server refers to title inside the OMA DM for DM servers.DM servers by OMA DM accounts with
Existing identifier server in device is associated.
ACL property and ACL values
There is the single DM trees since root node by all terminals of DM consultative managements, and DM agreements pass through manipulation
Each nodes of DM trees performs the management of terminal.For example, in order to which in the terminal, the software installation of download can be passed through execution
The node " installation " that matches with software installs software.Each node can indicate the simple information of such as numerical value and such as scheme
The complex data of graphic data or daily record data.In addition, node can indicate the order of " execution ", " download " etc..
Each node is provided with the attribute of associated metadata.Attribute includes reference node and section is generated from DM trees
Run time of the point to the duration of the extinction of node.During operation time attribute include ACL, form, title, size, title,
Timestamp, type and VerNo.
ACL is compulsory so that both terminal and servers need to realize ACL in 1.3 agreements of DM.ACL specifies spy
Determine the DM orders that DM servers can perform on a specific node.Not specified order can not be performed.In other words, ACL is referred to
The authority of specific DM servers is licensed to for specific node.In DM agreements, ACL is given the server mark to DM servers
Know and accord with and be not allocated to URI, IP address and DM server certificates.It is right in DM agreements that identifier server is used as being used for
The identifier that DM servers are authenticated.In addition, ACL as ACL property and can be supplied to the ACL value quilts of the ACL property
There is provided.In the description, ACL values are also referred to as ACL information or the information on ACL.In 1.3 agreements of DM, Suo Youjie
Point is defined as ACL property.All nodes with ACL property are defined as sky ACL values or non-NULL ACL values.
ACL has the unique attribute different from run time attribute.Unique attribute is inherited including ACL.ACL inherit refer to from
In the ACL values of the father node of node the design of ACL values is obtained to be included in DM trees and not having the node of ACL values.Such as
Fruit father node does not have ACL values yet, then the ACL values of father node are obtained from the ACL values of the father node of father node.Because in DM
Root node corresponding with the highest node of DM trees must have ACL values in agreement, so must inherited ACL value.It is pin that ACL, which is inherited,
DM orders performed to all ACL values rather than every perform.Therefore, inherited from the ACL of the father node of node only when node is had time
Just it is performed during ACL values.That is, if the ACL values of node are specified only " Add ", do not inherit unspecified " Get ".
In DM agreements, root node has the basic value of " Add=*&Get=* " as ACL.Here, " * " represents wildcard
Accord with and mean any DM servers.ACL values in order to obtain, DM servers use " Get " order.Related ./NodeA/Node1
" Get " order obtain the ACL values of ./NodeA/Node1.In order to change ACL values, " Replace (replacement) " has been used to order.
When to ./NodeA/Node1Prop=ACL performs " Replace " to set " Add=DMS1&Delete=DMS1&Get=
During DMS1 ", ACL values are changed.In DM agreements, it is impossible to change single acl entry and all ACL values can be changed.
Defined for obtaining and changing the authorities of ACL values based on ACL.Authority for internal node and for leaf node
Authority is variously defined.
- internal node:If corresponding node has " Get " authority and " Replace " authority, correspondence can be obtained and replaced
The ACL values of node." Replace " refers to the authority for the ACL values for being used for replacing all child nodes.
- leaf node:If the father node of corresponding node has " Replace " authority, the ACL of corresponding node can be replaced
Value.Father node needs " Get " authority to obtain the ACL of corresponding node.Similarly, if corresponding node has " Replace "
Authority, then can replace the ACL values of node.In order to replace ACL values, the father node of corresponding node needs " Replace " authority.
Pipe node is not internal node or leaf node, can be passed through for replacing the authority of ACL values of corresponding node
The ACL values of the father node of node control.If internal node has " replacement " authority, the ACL of all child nodes can be replaced
The ACL values of value and internal node.Therefore, can be for all nodes in DM trees if root node has " Replace " authority
With any authority.However, even if when father node has " Replace " authority, the power of such as " Get " is not also provided for child node
Limit and " Get ", and need directly to specify the authority of such as " Get " for child node.Therefore, it is necessary to the school before the execution of order
The ACL values of positive child node, and the ACL of child node is the ACL values by correcting all nodes before corresponding child node
Come what is corrected.This is inconvenient and then DM agreements so that the ACL values of corresponding node can be corrected directly, without being saved used in father
Point or ancestor node change the ACL values of intermediate node when having " Replace " authority.
When DM servers generate new node by ordering " Add ", the node that is generated in general without ACL values into
And obtain ACL values from its father node.However, working as, generated node is internal node and its father node does not have
During " Replace " authority, it is necessary to concurrently set and generated when node is generated to and provides and be used for and manage the authority of the node
Node ACL values.
It is used for the grammer for representing ACL values in [DM-TND] is defined.Exemplary ACL values are " Get=DMS1&Replace
=DMS1&Delete=DMS2 ".Here, DMS1 and DMS2 be DM identifier servers and " Get ", " Replace " and
" Delete " is DM orders.Therefore, DM servers DMSI can perform corresponding node " Get " and " Replace " and DM takes
Being engaged in device DMS2 can be to corresponding node execution " Delete ".Here, Get=DMS1, Replace=DMS1 and Delete=DMS2
It is acl entry and represents the single command authority of DM servers.In other words, ACL values are the set of single acl entry
And the ACL values of each node can include at least one acl entry.
DDF (device describing framework)
DDF is to describe management syntax and semantic specification for how to be directed to specific device types.DDF was provided on end
The information of the MO at end, management function and DM.
1.3 certifications of DM
DM 1.3 is based on ACL and performs certification.DM certifications are performed per DM orders.If DM servers have sent multiple DM lives
Order, then DM clients (hereinafter referred to as DMC) perform certification before the execution of order and execution is only as certification
As a result the DM orders permitted.
DM trees
DM trees refer to the set by the DMC MO examples exposed.DM trees are served as by the management server interacted with client
Interface.For example, management server can store particular value and particular value is retrieved from DM trees and manipulates the attribute of DM trees.
In environment of multi-server, multiple servers can be connected to a terminal to manage the terminal or use by the end
The service provided is provided.Terminal can provide service of the form for resource or resource group.That is, terminal can be incited somebody to action according to terminal
Specific resources (group) are exposed to server and enable the server to perform the such a of particular server by operating resource
Mode provides special services to server.
In the presence of with managing the corresponding server of access privileges manager for the access rights of resource (group).When for providing
The access privileges manager in source is unique and is able to access that in the presence of other servers of resource, can delete corresponding resource
The server account of manager.In this case, because having deleted the account of the access privileges manager for resource, institute
Access rights management can be performed for corresponding resource with no server, which service can be set into without server
Device is able to access that resource (for example, for the corresponding authority of order with particular command) and/or cancels and sets.Therefore, it is of the invention
Provide even if when deleting the server account of access privileges manager also for the connected reference authority pipe for resource
The purpose of reason is set based on the access rights from the other servers being able to access that among other servers of corresponding resource
The method of access privileges manager server.
Fig. 1 is exemplified with the data structure being stored in M2M clients.M2M clients (or terminal) can have with being claimed
For the corresponding entity of group of the resource of " object " corresponding with the function that can be realized by M2M clients.Can be in object specification
Defined in object identifier, and undefined identifier in object specification can use M2M systems by operator or manufacturer
System setting.Resource is to store the entity of data and can have multiple resource instances.Each object is used as by specific operation
Object instance is generated and instantiates, and M2M clients can access corresponding resource by the object instance.
" object " is the definition for the one group of resource that be used for specific function (feature) or purpose, and " object is real
Example " is (establishment) resource group of the instantiation for the object being directed in terminal.In order to use the function of object, it is necessary to generate object
Example.
Specifically, conceptually " object " of the template corresponding to the resource group to be instantiated or blueprint defines what is instantiated
Resource group can with resource, resource with attribute (such as the identifier of resource, title, support operational order, scope,
Unit and specification) and according to specific action command perform operation." object instance " be according to the definition of object in the terminal
Instantiation or existing resource group.The resource of resource group can have respective value.
In the description being provided below, " object " can interchangeably make with " group for supporting resource " or " definition of resource group "
With, and " object instance " can be interchangeably used with " group of instantiation resource " or " resource group ".
In addition, the information for the operation that instruction is supported by resource is included in the resource or is added to the resource.There are behaviour
Make " reading ", " write-in ", " execution ", " write-in attribute ", " it was found that ", " observation " etc..
Fig. 2 is exemplified with resource model according to the embodiment of the present invention.According to the embodiment of the present invention, ACL (is accessed
Control list) and AT (access type) be allocated for control for will be used in M2M systems in resource access rights.
ACL is distributed according to resource (that is, according to object instance) corresponding with specific function.Under each object example
Portion's resource is considered being assigned with identical ACL.That is, because ACL is distributed according to object instance, each object
The lower part resource of example has identical ACL.
Because object instance is entity corresponding with resource group and is performed for the group of specific function, when for
Particular server should be for the identical authority of all resource grants in group when have granted the authority for specific function.When not
When permitting identical authority, funtion part can be directed to operation is performed.In this case, the function of server thickens
And the meaning of permission right is unclear.Therefore, in embodiments of the present invention, as described above, ACL is according to object
Example allocation, with the storage of every resource compared to reduction expense, and to be simplified by using identical mechanism searching ACL
Access authority authentication process.
For reference, each object can be made to be instantiated as multiple object instances.
AT can be according to resource allocation and define the access scheme supported by each resource.For example, work as access side
When case is defined as operation, AT can be defined as specific operation, for example, " reading ", " write-in " and " execution ".
ACL and AT can be represented by different terms.For example, ACL can be referred to as access rights and AT can be referred to as
It can support to operate.
Interface
To be given at before the description of embodiments of the present invention between server and client (terminal) send it is specific
The description of the interface of operation.
There are four interfaces related to the present invention:1) guiding, 2) device (client) registration, 3) device management and service
Realize and 4) information is reported.Can will be uplink operation and downlink operation for the activity classification of four interfaces.
The operation of interface is shown in following table.
[table 1]
Fig. 3 is exemplified with four interfaces.Fig. 3 (a) is exemplified with the operation model for guiding interface.For guiding interface, behaviour
Make the uplink operation (i.e. the guiding of client terminal start-up) including being referred to as " request guiding " and referred to as " write-in " and " delete
Except " downlink operation (i.e. the guiding of startup of server).These operations are used for starting for client to one or more
Object necessary to a server registration.Guiding is using factory's guiding (for example, being stored in flash memory) or from intelligence
The guiding (storage within a smart card) of card defines.
Fig. 3 (b) is exemplified with the operation model for " device (client) registration " interface.For device registration interface, deposit
In the uplink operation referred to as " registration ", " renewal " and " un-register "." registration " is used for the information registering of client
In the server and " renewal " is used for periodically or according to the event generated in client registering in the server to update
Client information or state." un-register " is the operation for the registration for cancelling user end to server, and server energy
The enough information that client is deleted according to " un-register ".
Fig. 3 (c) is exemplified with the operation model for " device management kimonos is pragmatic existing " interface.For " device management kimonos
It is pragmatic existing " interface, exist referred to as " reading ", " establishment ", " write-in ", " execution ", " write-in attribute " and " it was found that " downlink chain
Dataway operation.These operations be used to interact with the resource of client, resource instances, object and object instance." reading " operates
For reading the currency of one or more resources, " write-in " operation be used for update one or more resources value and
" execution " operation is used for starting the operation by resource definition." establishment " operates and " deletion " operation is used for creating and deleting object reality
Example." write-in attribute " be used for set the attribute related with " observation " operation and " it was found that " for find correspond to attribute.
Fig. 3 (d) is exemplified with the operation model for " information report " interface.For information reporting interface, exist and be referred to as
The downlink interface of " observation " and " cancelling observation " and the uplink interface referred to as " notice ".Information reporting interface is used
To send the new value related with the resource in client to server." observation " is used for server and resource is changed in the server
Specific resources are observed when becoming interested and when no longer performing corresponding observation (when server is no longer desire to know resource changing
When) use " cancelling observation "." notice " is used for notifying to set by " write-in attribute " to server when meeting observation condition attribute
Fixed observation condition attribute.
For the data model of access control
In order to reduce the resolving expense of M2M devices and space expense, the identifier server to being suitable for M2M environment
(ID), ACL (or access rights) and AT (or can support to operate) are modeled.
- short server ID
Need to be included in the behaviour that the information in ACL must include indicating on the information and server of server
Make.Server ID is probably considerably long, because in general server ID is represented by URI.Since it is desired that according to object instance
Represent ACL and long server ID is repeatedly used object instance, so server ID can be according to the quantity of object instance
And cause sizable space expense.Therefore, the present invention is proposed has the short of regular length (such as 2 bytes) for ACL
The use of server ID.M2M clients store the mapping relations between short server ID and server ID, and can be from
Operation that the corresponding server of server ID receives and search short server ID corresponding with server ID and short using this
Server ID performs certification by corresponding A CL.
[table 2]
Accesses control list (ACL) or access rights
ACL is distributed according to object instance and corresponding to the row for the acl entry that access rights are specified for M2M servers
Table.Acl entry can be represented by the short server ID and access rights of corresponding server.Short server ID and access right limit value quilt
It is set as fixed short length to improve the space expense and treatment effeciency during verification process.On access rights, each M2M
Operation is assigned with unit value so that specific operation is certified with so as to improve treatment effeciency by only reading unit value.It can set
The fixed default acl entry for being used for the server in addition to the server on ACL, and M2M clients can receive relative to
Specific short server ID (such as 0x0000) is not searched in the operation of the Servers-all on ACL and uses corresponding visit
Authority is asked to be authenticated to operation.
[table 3]
Acl entry shown in table 3 is exemplary and can be set to different values.
Access type (AT) can be supported to operate
AT can specify the operation supported by resource.One position is reflected according to the mode identical with the access rights of acl entry
It is mapped to an operation.
[table 4]
Access type shown in table 4 is exemplary and can be set to different values.
By the operation for being given at described in aforementioned embodiments and using in the present specification and the letter of object (example)
Describe.
- 1. are directed to the operation of " device (client) registration " interface
Registration
Registration is performed when M2M clients send operational order " registration " to M2M servers.When M2M devices are switched on simultaneously
And during bootup process completion, M2M clients should take for each M2M corresponding with the server object example of M2M clients
Business device (that is, each server that M2M clients are registered to it) operation command " registration ".Following table is described for operating life
Make the parameter of " registration ".
[table 5]
Renewal
The particular event that is periodically or based in M2M clients or by M2M startup of server, M2M clients can be to
M2M servers send operational order " renewal ", so as to update the log-on message in log-on message and M2M server therein.Behaviour
Order " renewal " should include relative to the only change enumerated in the following table to the parameter finally registered that M2M servers are sent
Parameter.
If M2M clients are bound using UDP for the communication with M2M servers and in the IP address of M2M clients
Or change in port, then M2M clients must send operational order " renewal " to M2M servers.
[table 6]
Parameter | It is necessary |
Service life | It is no |
Binding pattern | It is no |
SMS numbers | It is no |
Object and object instance | It is no |
Operational order " renewal " can be by M2M servers via " the register update trigger " for M2M server objects
The operational order " execution " of resource starts.
Un-register
When being determined that M2M clients no longer can be by M2M server by utilizing (for example, the operation of M2M devices be reset), M2M visitors
Family end must send operational order " un-register " to M2M servers.When receiving this operational order, M2M servers should
This is from the log-on message wherein removed on M2M clients.
- 2. are directed to the operation of " device management kimonos is pragmatic existing " interface
Read
" reading " operation be used for access (reading) single resource, the resource instances of array, object an object instance or
The value of all object instances and there is following parameter.
[table 7]
It was found that
" it was found that " operate single resource, object instance and the attribute (parameter) for being used for being found to be object setting." it was found that " behaviour
Make that the resource realized in Finding Object can be used for.Return value corresponds to the answering for each resource for the attribute for including resource
With the list of/link form CoRE links (application/link form CoRE links form for meeting RFC6690)." it was found that " operation
There is following parameter.
[table 8]
Parameter | It is necessary | Default value | Annotation |
Object ID | It is | - | Denoted object. |
Object instance ID | It is no | - | Denoted object example. |
Resource ID | It is no | - | Indicate resource. |
As " it was found that " operation specific function, when specifying the object ID being only among aforementioned parameters return on
Realize which resource and be configured to the information of observed parameter opposed, carry out object ID among autoregressive parameter and right when specifying
It can be returned during as example ID for the observed parameter for specifying object instance setting, and work as and specify pair from these parameters
As the observed parameter set for specific resources can be returned when ID, object instance ID and resource ID.
Write-in
" write-in " operation is used for changing multiple resource values in the resource instances or object instance of (write-in) resource, array.
Multiple resources in " write-in " operation license same object example change according to an order.That is, " write-in " operates energy
Enough access object instance (and single resource)." write-in " operation has following parameter.
[table 9]
Write attribute
" write-in attribute " operation is used for changing the attribute of (write-in) resource or object instance." write-in attribute " operation has following
Parameter.
[table 10]
Only parameter " minimum period ", " maximum cycle ", " being more than ", " being less than " and " step-length " is used in " observation " operation.
Parameter " maximum cycle " and/or " minimum period " be used for controlling " notice " operation by M2M clients be directed to observation object example or
How long once, resource is sent.Parameter " being more than ", " being less than " and " step-length " is just effective only when indicating resource ID.Only when resources-type
Type just needs to support parameter " being more than ", " being less than " and " step-length " when being digital (such as integer, decimal number).
Perform
" execution " operation is used for start-up operation by M2M servers and can be performed only for single resource.When for
M2M clients return to mistake when object instance or resource instances receive " execution " operation." execution " operation has following parameter.
[table 11]
Parameter | It is necessary | Default value | Annotation |
Object ID | It is | - | Denoted object. |
Object instance ID | It is | - | Denoted object example. |
Resource ID | It is | - | Indicate the resource to be performed. |
Create
" establishment " operation is used for generating object instance in M2M clients by M2M servers." establishment " operation is needed with not
One in the object instance or object that are instantiated is target.
The object instance generated by M2M servers in M2M clients should have the object class supported by M2M clients
Type and operated to M2M servers and notified from M2M client use device registration interfaces " registration " operation and " renewal "
Object instance.
The object of at most one object instance is supported when generating object instance should be assigned with 0 object instance ID.
" establishment " operation has following parameter.
[table 12]
Delete
" deletion " operation is used for the object instance in M2M servers deletion M2M clients.It is objective from M2M by M2M servers
The object instance deleted in the end of family should be by M2M client use device registration interfaces " registration " operation and " renewal " operation
The object instance notified to M2M servers." deletion " operation has following parameter.
[table 13]
Parameter | It is necessary | Default value | Annotation |
Object ID | It is | - | Denoted object. |
Object instance ID | It is | - | Indicate the object instance to be deleted. |
- 3. are directed to the operation of " information report " interface
Observation
M2M servers can start the object instance or all objects to the specific resources in M2M clients, object
The observation request of resource in example.Relevant parameter for " observation " operation is operated by " write-in attribute " to set." see
Survey " operation includes following parameter.
[table 14]
Notice
" notice " operational order is sent to during effective observation for object instance or resource from M2M clients
M2M servers.This operational order includes the new value of object instance or resource.When satisfaction passes through " write-in attribute " operational order pin
During all conditions (that is, minimum period, maximum cycle, " being more than ", " being less than ", " step-length ") set to " observation " operational order
Need to send " notice " operational order.Notice operational order includes following parameter.
[table 15]
Cancel observation
" cancel observation " operation is sent to M2M clients from M2M servers and is directed to object instance or resource to cancel
Observation." cancelling observation " operation has following parameter.
[table 16]
Access control method
The description of the access control method of another embodiment according to the present invention will be provided.
- access rights obtain
When M2M clients have M2M server object examples, M2M clients are useful for without being subjected to corresponding to single M2M
In the case of the access control of server corresponding resource is accessed (that is, in the case of without checking access control object instance)
Authority.
If M2M clients have two or more M2M server object examples, M2M clients are relative to will access
Object instance or the object instance of resource including to be accessed in access control object instance search corresponding server
ACL.If ACL includes access rights corresponding with corresponding M2M server IDs, corresponding M2M servers have access rights.If
The acl entry of corresponding M2M server IDs is not present, then M2M clients check whether ACL includes distributing to default server ID's
Access rights.In the presence of default server ID, corresponding M2M servers have the access rights of default server ID.Taken when with M2M
When the corresponding access rights of business device ID and the access rights of default server ID are not present, corresponding M2M servers have no right to access institute
Corresponding object instance or resource.
- access control object
Access control object is used for checking the access rights whether M2M servers are useful for performing operation.It is each to access control
Object instance processed includes the ACL for the particular object instance being directed in M2M clients.
[table 17]
- verification process
In order to by the verification process for the operation sent from M2M servers, it is necessary to meet following.First, M2M takes
Business device needs authority (the i.e. access right for performing the operation sent for corresponding resource (such as object instance or resource)
Limit).Secondly, corresponding resource needs to support transmitted operation.Access authority authentication process according to the embodiment of the present invention
Performed by two steps in hierarchical structure.
M2M clients to M2M servers when the authority of corresponding resource is not present for accessing by sending error message
And M2M is notified to service by being sent when corresponding resource does not support operation to M2M servers on the information of corresponding resource
Operation transmitted by device is not performed due to specific resources.It is different for three ranks (that is, resource, object instance and object)
Ground performs verification process.
- for the operation of resource
If M2M server access single resources, i.e. M2M servers are sent relative to single resource to M2M clients
Operate, then M2M clients can include single resource according to aforementioned access authority acquiring method to obtain M2M servers and be directed to
The access rights of object instance and check whether the access rights are licensed and perform operation.
When mustn't be operable, M2M clients need to send instruction " license of access rights is rejected " to M2M servers
Error code.
When permit operation, whether M2M client validations single resource is supported to operate.
If operation is supported by single resource, M2M clients need to send instruction " behaviour to M2M servers
Do not support " error code.
When operation is supported by single resource, M2M clients are able to carry out operating.
- for the operation of object instance
As M2M server access object instance (that is, behaviour of the M2M servers to the transmission of M2M clients relative to object instance
Make) when, M2M clients can obtain the access that M2M servers are directed to object instance according to aforementioned access authority acquiring method
Authority and check whether the access rights are licensed and perform operation.
When mustn't be operable, M2M clients need to send instruction " license of access rights is rejected " to M2M servers
Error code.
When permit operation, M2M clients are able to carry out the procedure below based on the operation.
Operated for " write-in ", the M2M visitors only when all resources relative to transmitted operation support " write-in " operation
Family end can perform the operation relative to object instance.(if relative to transmitted operation) any resource is not supported
" write-in " operates, then M2M clients can by the error code of instruction " operation do not support " is sent to M2M servers come to
M2M servers notice does not support the resource of operation.
Operated for " reading ", M2M clients can retrieve all moneys in addition to not supporting " to read " resource that operates
Source and to M2M servers send on the information of the resource retrieved.
Operated for " establishment ", only when all resources relative to transmitted operation support " write-in " to operate and specify
M2M clients can perform the operation relative to object instance during all compulsory resources.If (relative to transmitted
Operation) any resource do not support " write " operation, then M2M clients can to M2M servers send indicate " operate do not prop up
Hold " error code with to M2M servers notice do not support operation resource.When not specified all compulsory resources, M2M visitors
Family end can send error code " false request (Bad Request) " to M2M servers.
For " deletion " operation, " observation " operation, " write-in attribute " operation or " find " operate, M2M clients needs hold
The row operation.That is, whether M2M clients need be by belonging to this without checking relative to the operation of object instance
All resources of object instance are to perform " deletions " operation in the case of supporting, " observation " operation, " write-in attribute " operate or " send out
It is existing " operation.
For the operation in addition to aforementioned operation, M2M clients need not perform the operation and need to send out to M2M servers
Send the error code of " operation is not supported ".
Whether M2M servers have access rights for object instance is determined by aforementioned access authority acquiring method
's.Then, it checked and belong to the single resource of object instance and whether support to operate.This process is performed according to action type.
- for the operation of object
Operation for object is defined according to action type.
When M2M servers by object send " reading " operate (that is, M2M servers to M2M clients send relative to right
" reading " operation of elephant) when, M2M clients can be collected on from belonging among (lower part) object instance of the object
M2M servers have the information of the object instance of access rights and collected information are sent to M2M servers.M2M is serviced
It is come definite according to aforementioned access authority acquiring method that whether device, which has access rights,.
The information for having the object instance of access rights on M2M servers is referred on except not supporting " to read " money operated
Outside source by M2M client-side search to resource information.
When M2M servers by object send " establishment " operate (that is, M2M servers to M2M clients send relative to this
" establishment " operation of object) when, whether M2M clients can check M2M servers according to aforementioned access authority acquiring method
There are access rights for the object.
When M2M servers have access rights for the object, M2M clients are only in all resources sent according to operation
Support " write-in " to operate and can perform operation when specifying all compulsory resources.If (relative to transmitted behaviour
Make) any resource do not support " write " operation, then M2M clients can be by " operating and not supporting " to the transmission of M2M servers
Error code come to M2M servers notice do not support operation resource.If not specified all compulsory resources, M2M visitors
Family end can send error code " false request " to M2M servers.That is, M2M client notification M2M servers according to
The operation of M2M servers is incorrect.
" it was found that " operation in the case of, M2M clients need to perform the operation.That is, M2M clients do not check
Whether M2M servers have access rights and do not check and belong to object instance for all lower part object instances of corresponding objects
All resources whether support " it was found that " operation.
" it was found that " operation or " write-in attribute " operate in the case of, M2M clients need to perform the operation.Namely
Say, operated for " observation " operation or " write-in attribute ", whether M2M clients do not check M2M servers for all of object
Lower part object instance has access rights and belongs to all resources of object instance whether support " to observe " operation or " write-in belongs to
Property " operation.
For the operation in addition to aforementioned operation, M2M clients should not perform the operation and can be to M2M servers
Send the error code of " operation is not supported ".
It is to pass through aforementioned access according to the specific operation for the object that whether M2M servers have access rights for object
Authority acquiring method is come definite.Then, whether the single resource that checked the object instance for belonging to object is supported to operate.According to
Action type performs this process.For the specific operation relative to object, it may not check whether M2M servers have access
Authority and whether support specific operation.
Hereinafter, server security object (or object instance), server object example (or object be there will be briefly described
Example) and firmware upgating object (or object instance).
M2M server securities object (or object instance), which provides, to be suitable for accessing specific M2M servers or M2M guiding clothes
The key material of the M2M clients of business device.One object instance is recommended to be addressed to M2M Boot Servers.M2M is serviced
The resource of device mounting object can be changed by M2M Boot Servers or smart card via guiding interface, but can not be by
Any other M2M server access.
[table 18]
Object | Object ID | Object URN | Multiple examples | It is compulsory |
LWM2M safety | 0 | It is multiple | It is compulsory |
[table 19]
Next, the description of M2M server objects (or object instance) will be provided.M2M server objects are provided to be taken with M2M
The related data of business device.M2M Boot Servers do not have associated object instance.
[table 20]
Object | Object ID | Object URN | Multiple examples | It is compulsory |
LWM2M servers | 1 | It is multiple | It is compulsory |
[table 21]
The present invention solves inefficient caused by when deleting the account of M2M servers from M2M clients.Work as deletion
During the accounts of M2M servers, the access rights that M2M servers are directed to specific resources are also deleted.The access rights to be deleted can
Difficulty can be caused in the continuous management of resource.In addition, when deleting only access rights, the resource that access rights are not present is protected
Hold in M2M clients.In this case, resource becomes the entity that none is able to access that.When in M2M clients
When generating event, the configuration for indicating the event can be set.When deleting M2M server accounts by discharging configuration
Perform efficient resource management.
The access rights owner
The access rights owner is the entity for the ACL that can change specific resources.The access rights owner can have spy
Determine access rights (such as authorizing access rights) and can be stored separately in specific fields (for example, access control owns
Person's field or from permission field) in manage corresponding A CL.As shown in table 17, there may be one or more access rights institutes
The person of having.
M2M server accounts can be deleted by foregoing guiding interface by M2M Boot Servers.Therefore, M2M pac servers
Family is that sending and receiving between M2M Boot Servers and the target M2M clients is deleted by specific action command.It is existing
It this will be described.
Guiding interface be used for submit necessary information to M2M clients so that M2M clients can utilize it is one or more
A M2M servers perform " registration " operational order.In the presence of four bootmodes supported by M2M enablers.
- factory guides:Guidance information is preset in M2M clients.
- the guiding from smart card:M2M clients receive guidance information from smart card.
The guiding of-client terminal start-up:M2M clients ask guiding to M2M Boot Servers and M2M Boot Servers add
/ deletion/is added to update the guidance information of M2M clients.
The guiding of-startup of server:The guidance information of M2M Boot Servers addition/deletion/renewal M2M clients.
M2M clients can support at least one bootmode specified in guiding interface.M2M servers can be supported to draw
All bootmodes specified in waveguide interface.
Guidance information, which refers to, to be needed to be configured in M2M clients to access the letter of M2M servers or M2M Boot Servers
Breath.Guidance information can be acquired before homing sequence by the result using or as homing sequence.Guiding can be believed
Breath is categorized as two types, i.e. the guidance information for the guidance information of M2M servers and for M2M Boot Servers.
M2M clients can have the guidance information for being used for M2M servers after homing sequence (for example, being serviced with M2M
Information necessary to device connection).In addition, M2M clients can have for M2M Boot Servers guidance information (for example, with
Information necessary to the connection of M2M Boot Servers).Guidance information for M2M servers is used for M2M clients and is taken to M2M
Business device is registered and is connected with M2M servers.
Guidance information for M2M servers can be set to "false" including at least wherein " Boot Server " resource
M2M server security object instances.Guidance information for M2M servers can include other object instances.
M2M clients can be configured with include the set of the guidance information for corresponding M2M servers two
Or more M2M server.Guidance information for M2M Boot Servers can be guided by M2M clients using to access M2M
Information is to obtain the guidance information for M2M servers.Guidance information for M2M Boot Servers can wherein " be drawn
Lead server " resource is set to the M2M server security object instances of "true".
Guidance information can be classified as follows.
[table 22]
M2M clients can receive in the case of no verification process (access control) by guiding drawing for interface transmission
Lead information.
Guiding interface optionally set M2M clients so that M2M clients successfully to M2M server registrations or with
M2M Boot Servers connect.Client guiding operational order be by via M2M Boot Servers/bs paths with including
The query string parameter of M2M client identifiers sends CoAP POST requests to perform.
When M2M Boot Servers receive request guiding operational order in the guiding of client terminal start-up, M2M guiding clothes
Business device is able to carry out write-in and/or delete operation instruction.In the guiding of startup of server, M2M Boot Servers are able to carry out
Write operation instructs.Write-in and/or delete operation instruction can be using object instances or resource as target.Can send write-in and/
Or delete operation instruction is multiple.Only in interface is guided, delete operation instruction can be target using "/" URI so as to from M2M client
Deleted in end all object instances in addition to M2M Boot Server accounts in M2M Boot Servers to M2M clients
M2M clients are initialized before sending write operation instruction.Discriminating device management and service realizes that the write operation in interface refers to
Order, no matter destination object example or resource there are M2M clients can write operation instruction Payload (i.e., it is intended to
Pass through the particular value of write operation instruction write-in).The operational order in guiding interface has been shown below.Write operation instructs
It can be replaced with another operational order (for example, establishment).
[table 23]
Homing sequence
M2M clients must comply with the homing sequence (step) specified as follows when attempting and guiding M2M devices.
If M2M devices have smart card, M2M clients try to obtain guidance information from smart card.
If without using the boot configuration M2M clients from intelligent mode card, M2M clients are tried by using work
Factory bootmode obtains guidance information.
If M2M clients have any M2M server objects example by previous step, M2M clients to M2M
The corresponding M2M servers request registration of server object example.
When M2M clients fail to all M2M server registrations and do not have any M2M server objects example,
The guiding that M2M clients waiting for server starts is worked as up to the time ClientHoldOffTime specified by specific resources
When the guiding of startup of server is not generated in the time, it is intended to obtain guidance information by the guiding of client terminal start-up.
The guiding of client terminal start-up
(presence) M2M servers account may not be set in M2M clients or performs " registration " behaviour using M2M servers
The trial of work may fail.In this case, M2M clients can use the bootmode of client terminal start-up so as to from M2M
Guidance information is retrieved in Boot Server.The bootmode of client terminal start-up can ask instruction (reference) M2M Boot Servers
M2M security server object instances be set and (exist) in M2M clients.
Fig. 7 is operated exemplified with the bootmode of client terminal start-up according to the embodiment of the present invention.M2M clients can
" boot request " operational order (S601) is sent to prespecified M2M Boot Servers URI.When M2M client requests guide
When, M2M clients can send " endpoint client end title " (the M2M client identifiers) of M2M clients as causing
M2M Boot Servers can provide the parameter of appropriate guidance information for M2M clients.
M2M Boot Servers can use " write-in " and/or " deletion " operational order to set guidance information (or to match somebody with somebody
Put) to M2M clients.
Client terminal start-up guides some resources that can be used for setting the guidance information of M2M clients initially to draw
Renewal guidance information after leading.For example, guidance information is optional, and then it can send or not send the guidance information.
The guiding of startup of server
In the case of the guiding of startup of server, M2M clients not to M2M Boot Servers send boot request and
M2M Boot Servers set guidance information in M2M clients." draw because M2M clients do not start M2M Boot Servers
Lead request " operational order, so M2M Boot Servers need to know before M2M clients are set by M2M Boot Servers
Whether M2M clients or M2M devices are ready to guide.The present invention does not provide the mechanism that M2M Boot Servers obtain this information.
For example, when M2M devices are connected to the network of network provider, the network of network provider notifies M2M to M2M Boot Servers
The scene whether device gets out guiding is possible.
When be notified of M2M Boot Server M2M devices be ready to receive guidance information when, M2M Boot Servers can make
With " write-in " and/or " deletion " operational order guidance information is set in M2M clients.
Fig. 5 is operated exemplified with the bootmode of startup of server according to the embodiment of the present invention.M2M Boot Servers
" write-in " and/or " deletion " operational order can be used to set guidance information (S701) in M2M clients.
Startup of server guides some resources that can be used for setting the guidance information of M2M clients initially to draw
Renewal guidance information after leading.In this illustration, guidance information is optional, and then can send or not send guiding letter
Breath.
Guidance information
Guidance information be the information sent by M2M Boot Servers and be used for M2M clients and M2M servers or
Necessary to M2M Boot Servers are connected/communicated.Guidance information can send and can draw by guiding interface
Used or be obtained as the result of homing sequence before leading sequence.
Guidance information is classified as M2M servers guidance information and M2M Boot Server guidance informations.M2M servers draw
Leading information includes M2M servers account and optional object instance (for example, access control object instance and network connection sex object
Example), and M2M Boot Servers guidance information includes M2M Boot Server accounts.
M2M servers account can store be connected to M2M servers necessary to information, server correlation function and related
The information of server correlation function.M2M Boot Server account storages are connected to information necessary to M2M Boot Servers.
M2M client trusts and reception meet the safety requirements of M2M servers (for example, data confidentiality, data are complete
Property and source certification) guiding message or by guide interface provide information.
Server info
Serviced for the communication between M2M clients and M2M servers, it is necessary to be provided by M2M Boot Servers with M2M
Essential information necessary to device communication and additional information (by guiding the information sent).The example of this information includes server
ID, server address (for example, IP, URI etc.), security credence, network carrying information, preferred network carrying information, can be by M2M
Resource of server generation etc..Specific M2M servers (correlation) guidance information may refer to server info.
Access control information
In order to access the specific resources of M2M clients, M2M servers are needed with the authority for being used to access the resource.Energy
It is enough to change access control relevant information (that is, accesses control list (ACL) or the resource including the ACL) by guiding.It can lead to
Cross or do not provide corresponding informance by guiding.
Configured for the access rights that server account is deleted
When deleting the account of M2M servers, it is also necessary to delete M2M servers from the ACL of corresponding M2M clients
Access rights.Here, when M2M servers for specific resources (such as object) are the unique access rights owners when, as above institute
State and there are problems that.Therefore, when the access rights of the M2M servers in addition to M2M servers to be deleted are present in M2M visitors
When in the ACL at family end, procedure below is able to carry out.
A) the prevention that server account is deleted
When deleting M2M server accounts, corresponding removal request can be prevented.For this reason, M2M clients can be
Receive after removal request together with representing that corresponding M2M servers send wrong sound for the message of the unique access rights owner
Should.In this case, the M2M servers (that is, guiding M2M servers) for asking to delete can change the access rights owner
For another M2M servers or deletion corresponding A CL and then M2M clients are asked to delete M2M server accounts again.
B) the access rights owner changes
When deleting M2M server accounts, M2M clients can change the access rights owner.Accessed for changing
The method of rights owner is as follows.
B-1) the M2M servers with highest access rights are set to the new access rights owner in ACL." most
Height " access rights mean to access interior influence corresponding resource or associated other resources most wide among access rights
Access rights.For example, the access rights ratio for " write-in " is used for the access right limit for height of " reading ".
Here, corresponding operational order can be directed to particular value is distributed to access rights respectively and can there will be spy
The M2M servers of the maximum sum of definite value are determined as the new access rights owner.For example, when M2M servers 1 are useful for " writing "
The access rights and M2M servers 2 of " reading " are useful for " writing " and during the access rights of " execution ", M2M servers 1 into
(value-write-in of order is distributed to for the new access rights owner:4, read:2, perform:1).
In addition, the value distributed to for the access rights of operational order is exemplary, and can be by identical value (example
As 1) distributed to the access rights for all operational orders.This means have access rights for a large amount of operational orders
M2M servers can be designated as the new access rights owner.
B-2) all M2M servers are designated as the access rights owner.Here it is possible to will be to corresponding M2M clients note
All M2M servers of volume are appointed as the access rights owner or can will have access rights only for corresponding resource
M2M servers are appointed as the access rights owner.When the default acl entry only for the unspecified server in ACL is kept
When this method be useful.
B-3) the first M2M servers in rights object example are designated as the access rights owner.
B-4) the access rights owner keeps M2M servers that are empty and accessing corresponding resource to be first designated as access right
Limit the owner.
C) resource is deleted
When deleting the account as the M2M servers of the access rights owner, M2M servers can be deleted and be designated
For the resource (such as specific access control object example) of the access rights owner.That is, even money is served as by deleting
The M2M servers of the owner in source delete resource.Here, the specific resources associated with resource and the specific money are also deleted
The access right limit value in source.
D) the new access rights owner's is specified
The M2M servers to be deleted can send the resource request power for being used as the access rights owner for M2M servers
The order of the mandate of limit.That is, specific M2M servers (the M2M servers that access rights will be granted to) be for
Server account delete operational order transmission before set and as the M2M servers deleted as access rights institute
The access rights owner of the resource for the person of having is added.
Alternatively, the operational order deleted for server account can be included in after the deletion of server account on
The information (ID of i.e. another M2M servers) of the access rights owner so that, can will be with bag when deleting server account
The corresponding server of the access rights owner included in the operational order deleted for server account is appointed as what is deleted
Server is the new access rights owner of the resource of the access rights owner.
Resource is deleted
When deleting the account of specific M2M servers, the specific M2M servers are deleted from ACL.When what is deleted
M2M servers are the access rights owners of specific resources (such as object) and when being the unique servers being present in ACL,
Not only the access control object instance including ACL but also the special object associated with the access control object instance can be deleted
Example.
After specific M2M servers account is deleted, it is particular event that corresponding client, which can be cancelled by specific M2M servers,
Previous report setting value.
Furthermore, it is possible to the aforementioned operation cancelled is deleted and reported to server notice such as access rights configuration, resource.
For the access control of observation
M2M servers may wish to receive on specific resources or resource group (such as object instance) from M2M clients
The report of change.For this report, it can check that resource or resource group change by foregoing " observation " function.It is however, right
" observation " function is registered there is no limitation, and then the effect that corresponding resource is read with (according to " reading " operational order) can be obtained
Identical effect.Therefore, the M2M servers for not having access rights for " reading " operational order can read corresponding resource
Value.
This, describes in the access control method when have registered " observation " function during the reporting period in order to prevent.
The access control method is suitable for other operational orders.That is, creating identical effect (or result)
In the case of operational order, access control can be performed by an access rights for operational order.The following table shows
For the exemplary access rights of operational order.
[table 24]
Observation registration
Fig. 6 is the flow chart registered exemplified with observation according to the embodiment of the present invention.
Server 100 can be that specific resources ask observation registration (S610) to client 200.Then, client can be with
Check whether M2M servers are useful for reading resource to obtain (such as the visit for " reading " operational order of the authority of the resource
Ask authority) (S620).When M2M servers have permission, client can be with the ID of storage server and corresponding resource (S630-1)
And server is notified successfully to handle observation registration (S640).When corresponding resource is changed, report processing is performed.
However, when M2M servers do not have authority, registration is not performed and client can notify server observation note
Volume has failed (S630-2).
Observation can be performed for being not carried out the resource of certification.For example, when M2M servers " observation " operational order only with
When object ID is target, the multiple object instances associated with the object indicated by the object ID there may be and M2M service
Device may not have " reading " authority at least one object instance.In this case, two methods are applied.
1. do not perform mandate and unconditionally receive resource during registration is observed.In such a case, it is possible to report
(M2M servers are corresponded to for it to be had " reading " object instance being only successfully authorized among object instance
Authority).Alternatively, authorized object instance is individually processed, and when one in authorized object instance is changed
, can be when M2M servers successfully authorize the object instance through change (that is, in M2M servers for corresponding during change
Object instance has during " reading " authority) report the object instance (i.e. single object instance).
2. it can be authorized and can be observed the object only authorized real to all object instances during registration is observed
Example.In this case, only when all object instances being successfully authorized during registration during observation report by into
When authorizing (this is that whether have access rights for " reading " operational order come definite according to M2M servers) work(, Neng Goubao
Accuse object instance.Otherwise, can be reported among the object instance being successfully authorized during registration only during the reporting period
It has been successfully authorized pair of (this is that whether there are access rights for " reading " operational order come definite according to M2M servers)
As example.Alternatively, the object instance being successfully authorized during registration is individually processed, and when the object authorized
When example is changed, can successfully having authorized the object instance through change in M2M servers, (this is to be according to M2M servers
It is no that to have access rights for " reading " operational order definite) when report object instance.
Observation report
Fig. 7 is the flow chart exemplified with observation report according to the embodiment of the present invention.
M2M servers can be changed between when have registered " observation " function and when reporting " observation " function
Access rights.Therefore, though when reporting " observation " function (that is, when changing observation report target resource) M2M client
End can also check whether M2M servers have " reading " access rights (S720) for corresponding resource." read when M2M servers have
Take " access rights when, M2M clients can report (notice) corresponding resource (S730-1).When M2M servers do not have " reading "
During access rights, M2M clients can cancel observation (and deleting observing function configuration) and be taken to the notice observation of M2M servers
Disappear (S730-2).
Observation report can be performed via information reporting interface by foregoing " notice " operational order, now will be to this progress
More detailed description.
Fig. 8 is the flow chart exemplified with observation according to the embodiment of the present invention and the notice responsed to which.
M2M servers ask to observe for the temperature updated in M2M clients with irregular cycle.
More specifically, M2M servers can ask to observe for the resource associated with temperature, set for the observation
The minimum period of 10 seconds and the maximum cycle of 60 seconds.As described above, this can be by " write-in attribute " operational order via " device
Interface is realized in management and service " and performed by " observation " operational order via " information reporting interface ".Specifically, it is used for
The parameter (i.e. minimum period and maximum cycle) of the detailed setting value of " notice " is set by " write-in attribute " operational order
(S810), and M2M clients can make this by sending the result (such as successful) of " write-in attribute " operational order
Respond (S820).
Then, M2M servers can be that the temperature associated with resource observes (S830) to M2M client requests.M2M visitors
Family end can respond (S840) request by sending the result (such as successful) of " observation " operational order.
At least 10 will also be waited before " notice " is sent to M2M servers by having changed M2M clients even if the value of resource
Second and can after 10 seconds to M2M servers notice resource value (S850).
When the value of resource changed after 40 seconds from notice, M2M clients can notify resource to M2M servers
Value (S860).
In addition, even if the value of resource not yet changes M2M clients and is also required to send " notice " (S870) in 60 seconds.
That is, notice timing is by notice configuration (i.e. minimum period and maximum cycle) limitation.More specifically, it is necessary to
Notice is sent between minimum period and maximum cycle at least once.
According to aforementioned arrangements, random time that can be after the change of resource between 10 seconds to 60 seconds sends " notice ".
Furthermore it is possible to cancel observation.This can be performed by foregoing " observation is cancelled " operational order.
" observation is cancelled " operational order is sent to M2M clients so as to for object instance or resource from M2M servers
Terminate observed relationships." observation is cancelled " operational order does not include parameter in M2M layers." observation is cancelled " operational order must be used
The response for " notice " operational order of opposing.
Cancel for observation, two methods can be used for M2M servers.
The transmission of-" observation is cancelled " operational order
According to the limitation of this option, if M2M servers receive " notice " operation no longer interested of M2M servers
Order, then M2M servers can be in response to " notice " operational order transmission " observation be cancelled ".
- include cancelling the transmission of " write-in attribute " operational order of parameter
This operation does not limit.If specific URI of the M2M servers into M2M clients, which is sent, to be included cancelling parameter
" write-in attribute " operational order, then M2M clients can cancel observation for the specific URI.
Cancel pattern configurations
M2M servers can configure connection mode.The sleep cycle that connection mode is configured to increase device subtracts
The purpose of baby battery power consumption and can be used for maintain more reliable communication.
- always on
M2M servers can make M2M clients keep online by configuring.In this state, M2M servers if necessary
Order (administration order or operational order) can be sent to M2M clients at any time.
- event-driven is online
M2M servers can make M2M clients enter presence according to configuration by event.In this state,
M2M clients can send the online message of expression M2M clients after generation event and wait the order of M2M servers
(administration order or operational order) is specific up to special time or when continuously being sent to M2M servers while Wait Order is waited
During order from final order wait special time.
- periodically online
M2M servers can periodically maintain presence by configuring M2M clients.M2M clients
The message of instruction presence can be sent to M2M servers and waits order (administration order or the operation life of M2M servers
Make) reach special time or work as to be spaced in life of the wait from M2M servers by the interval or preformulation of M2M server settings
When continuously sending particular command to M2M servers while order from final order wait special time.Interval is not objective with M2M
The event generated in the end of family is related, and M2M clients can send the report of collected offline with the interval to M2M servers
Information.
Alternatively, M2M servers can determine the time when M2M clients are reached the standard grade.Every afternoon is set for example, working as
3:When 05, M2M clients send new information so that M2M servers are able to carry out specific action command in the corresponding time.It is super
When be likely to be present in setting time.In the presence of time-out, M2M clients maintain presence until corresponding with M2M servers
Untill time.
- pattern changes consideration
In the case where event-driven is online or periodically online, M2M servers can not perform with M2M clients can
By communication.When needing continuous communiction (for example, for firmware renewal when), M2M servers can be sent in M2M clients
The order of always on pattern is changed into when being temporarily online.At the end of continuous communiction, M2M servers can be by one
Straight on-line mode changes into previous pattern or other patterns.In addition, M2M servers can enable always on pattern by
Maintain.
- event level consideration
Event can have rank.Can according to the change from sleep pattern (or off-state) to on-line mode whether be
What is needed is categorized as event level two ranks.
In the case of the necessary event of change to on-line mode, M2M clients immediately enter online in the corresponding time
State is to perform report.In the case of the unnecessary event of change to on-line mode, when M2M clients are due to other reasons
And M2M clients can report corresponding event when entering presence.
Fig. 9 is the flow chart exemplified with operation according to the embodiment of the present invention.
Terminal can receive the operational order (such as " deletion " for the account for being used to delete particular server from first server
Operational order) (S910).In the present invention, server account is not limited to the title of object instance and refers on special services
The set of the information of device.More specifically, server account includes aforementioned server object (example) and Security Object (example).Separately
Outside, server account means that " Boot Server " resource in Security Object (example) is set to "false".
Can by guide interface be used for delete operational order, and then first server can be guide service
Device.
Terminal can determine whether the object instance associated with particular server includes only being accessed by particular server
Object instance (S920).
When the object instance associated with particular server includes the object instance that can be only accessed by particular server, eventually
End can delete the object instance and access object instance (S930) associated there.That is, terminal can delete spy
Determine the access authority information of server.Because corresponding object instance is not associated with other servers, works as and delete
Object instance and access object instance associated there can not be by any server access during the account of particular server.Cause
This, it is expected to delete object instance and access object instance associated there.
When the object instance associated with particular server include can be by multiple server access including particular server
Object instance when, terminal can be deleted in the access object instance associated with corresponding object instance and special services
The resource (for example, acl entry of aforementioned access control object example) (S931) that device is associated.This is because it is preferential only delete with
The resource that particular server is associated, because other servers are able to access that other examples, distinguishes with S930.
In addition, terminal can determine particular server whether be access control object instance the access control owner
(S932)。
When particular server is the access control owner of access control object instance, terminal can use following methods
To set the new access control owner (S933) for access control object instance.This is used to resolve/prevent due to for accessing
Inconvenient resource management and resource profit caused by the shortage of the manager (that is, the access control owner) of control object example
Purpose.
Particular value is according to specifying the access rights of (perhaps can) to distribute by access control object instance.For example, pin
The access rights of " write-in " operational order can be distributed with " 1 " and the access rights for " reading " operational order may distribute
“2”.Terminal can be directed to each server calculated value and and be new access control by the server settings with highest sum
The owner processed.When two or more servers have it is identical and when, terminal can select one in these servers simultaneously
And by selected server settings it is the new access control owner.
When particular server is not the access control owner of access control object instance, S933 is skipped.
Then, terminal can check whether particular server has access rights for all object instances of terminal
(S940).That is, terminal can check that particular server has the operational order of access rights.If particular server for
Operational order with the presence of access rights object instance, then terminal can be back to S920 with repeat the present invention operation.Also
It is to say, the operation of the present invention can be repeated until having the resource of the operational order of access rights which specify particular server not
In the presence of untill.
After the operational order that definite particular server has access rights is not present, terminal can be cancelled by particular server
The observation operative configuration (S950) of setting.Grasped that is, terminal can be deleted by " observation " sent from particular server
Make the configuration information of order storage.
Then, terminal can delete the account (S960) of particular server completely.That is, although received in S910
To particular server account removal request, but the account of particular server is practically deleted in step S960.When holding first
Gone delete command when, delete the information of such as short server ID in server account, be based on into being unable to find needs
The acl entry that short server ID is deleted, because short server ID has been deleted.Therefore, server account is finally deleted.This
Outside, terminal can send " un-register " operational order (S970) for particular server.
May be related with the description referring to figs. 1 to Fig. 8 with reference to the embodiment of Fig. 9 descriptions, and then those skilled in the art
Description is referred to as described in Fig. 1 to Fig. 8 to delimit the embodiment on Fig. 9.
Terminal can select only some steps shown in Fig. 9 and perform selected step.
Figure 10 is the block diagram for the equipment for being used for realization embodiments of the present invention.Transmitter 10 and receiver 20 wrap respectively
Include:Radio frequency (RF) unit 13 and radio frequency (RF) unit 23, it, which is used to send and receive, carries information and/or data, signal, message
Deng RF signals;Memory 12 and memory 22, it stores the information related with the communication in wireless communication system;And processing
Device 11 and processor 21, it is operably connected to RF units 13 and RF units 23 and memory 12 and memory 22 and controls
RF units 13 and RF units 23 and memory 12 and memory 22 processed so that transmitters and receivers perform the implementation of the present invention
It is at least one in mode.
Memory 12 and memory 22 can store for handle and the program of control processor 11 and processor 21 and
Temporarily storage input/output information.Memory 12 and memory 22 potentially act as buffer.
Processor 11 and processor 21 control the overall operation of the module in transmitters and receivers.Specifically, processor
11 and processor 12 be able to carry out being used for realization the various control functions of the present invention.Processor can be referred to as controller, micro-control
Device processed, microprocessor, microcomputer etc..Processor 11 and processor 21 can be by various means (for example, hardware, firmware, soft
Part or its combination) realized.When the present invention using hardware to realize when, be configured as realize the present invention ASIC (special collection
Into circuit), DSP (digital signal processor), DSDP (digital signal processing device), PLD (programmable logic device), FPGA
(field programmable gate array) etc. can be included in processor 11 and processor 12.When the present invention is come using firmware or software
When realizing, firmware or software can be configured as including module, process, the function for being used to perform the functions or operations of the present invention
Deng.It is configured as realizing that the firmware of the present invention or software can be included in processor 11 and 21 or be stored in memory 12
Performed with memory 22 and by processor 11 and processor 21.
In embodiments of the present invention, M2M servers, M2M clients, server or terminal can be operated as wherein
The equipment for assembling or being provided with M2M servers, M2M clients, server or terminal, i.e. transmitter 10 or receiver 20.
It can be configured so that as the M2M servers of transmitter or receiver, M2M clients, server or terminal
Previously described embodiment of the invention independently applied or two or more be simultaneously applied.
, can be by it will be understood by those skilled in the art that in the case where not departing from the spirit of the present invention and necessary characteristic
The present invention is performed according to other ad hoc fashions in addition to those modes described in this paper.The above embodiment therefore will be in all sides
Face is interpreted illustrative rather than restricted.The scope of the present invention by appended claims and its legal should be equal
Thing determines, without being determined by foregoing description, and fall in the meaning and equivalent scope of appended claims all changes
Change, which is intended to, to be included therein.
Industrial applicability
The present invention can be used for terminal, base station, server or the miscellaneous equipment of mobile radio system.
Claims (14)
1. it is a kind of handled in a wireless communication system due to the deletion of the account of server by terminal it is related to the server
The method of the particular object instance of connection, this method comprise the following steps:
The operational order for the account for being used to delete particular server is received from first server;
When the particular object instance is the object instance for only allowing to be accessed by the particular server, it is described specific right to delete
As example and the access control object instance associated with the particular object instance;
When the particular object instance is to allow the object instance by multiple server access including the particular server,
The access right of the particular server is deleted from the access control object instance associated with the particular object instance
Limit information;And
When the particular server is unique access control owner of the access control object instance, will come from except described
The server with highest access rights among the multiple server outside particular server changes into the access control
The access control owner of object instance processed.
2. according to the method described in claim 1, wherein, the change comprises the following steps:When existing there is the highest to visit
When asking two or more servers of authority, one in the two or more servers is selected, and by selected by
Server change into the access control owner.
3. according to the method described in claim 1, wherein, the operation of the account for deleting the particular server
Order is by guiding interface.
4. according to the method described in claim 1, wherein, the first server is Boot Server.
5. according to the method described in claim 1, this method is further comprising the steps of:If it is the visit by second server
Ask that the access control owner of control object example sets " observation " operation, then send and be directed to the second server
The notice of change of the access control owner when the access control owner is changed.
6. according to the method described in claim 1, this method is further comprising the steps of:Delete by being sent out from the particular server
The configuration information related with " observation " operational order for " observation " operational order storage sent.
7. according to the method described in claim 1, wherein, the account of the particular server includes the particular server
Short server ID and the safe key for communicating with the particular server.
8. it is a kind of be configured as handling due to the deletion of the account of server in a wireless communication system it is associated with server
Particular object instance terminal, which includes:
Radio frequency unit;And
Processor, the processor are configured as controlling the RF units,
Wherein, the processor is configured as:The operation life for the account for being used to delete particular server is received from first server
Order;When the particular object instance is the object instance for only allowing to be accessed by the particular server, it is described specific right to delete
As example and the access control object instance associated with the particular object instance;When the particular object instance be allow by
During the object instance of multiple server access including the particular server, from the institute associated with the particular object instance
State the access authority information that the particular server is deleted in access control object instance;And when the particular server is
During unique access control owner of the access control object instance, by from described more in addition to the particular server
The server with highest access rights among a server changes into the access control institute of the access control object instance
The person of having.
9. terminal according to claim 8, wherein, the processor is configured as:When existing there is the highest to access
During two or more servers of authority, one in the two or more servers is selected, and will be selected
Server changes into the access control owner.
10. terminal according to claim 8, wherein, the behaviour of the account for deleting the particular server
It is by guiding interface to make order.
11. terminal according to claim 8, wherein, the first server is Boot Server.
12. terminal according to claim 8, wherein, if being the access control object instance by second server
The access control owner set " observation " operation, then the processor be configured as to the second server send
For the notice of change of the access control owner when the access control owner is changed.
13. terminal according to claim 8, wherein, the processor is configured as deleting by from the special services
The configuration information related with " observation " operational order for " observation " operational order storage that device is sent.
14. terminal according to claim 8, wherein, the account of the particular server includes the special services
The short server ID of device and the safe key for communicating with the particular server.
Applications Claiming Priority (11)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201361753932P | 2013-01-18 | 2013-01-18 | |
US61/753,932 | 2013-01-18 | ||
US201361786625P | 2013-03-15 | 2013-03-15 | |
US61/786,625 | 2013-03-15 | ||
US201361818918P | 2013-05-03 | 2013-05-03 | |
US61/818,918 | 2013-05-03 | ||
US201361823411P | 2013-05-15 | 2013-05-15 | |
US61/823,411 | 2013-05-15 | ||
US201361827730P | 2013-05-27 | 2013-05-27 | |
US61/827,730 | 2013-05-27 | ||
PCT/KR2014/000425 WO2014112781A1 (en) | 2013-01-18 | 2014-01-15 | Method and apparatus for controlling access in wireless communication system |
Publications (2)
Publication Number | Publication Date |
---|---|
CN104937895A CN104937895A (en) | 2015-09-23 |
CN104937895B true CN104937895B (en) | 2018-04-24 |
Family
ID=51209827
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN201480005392.9A Active CN104937895B (en) | 2013-01-18 | 2014-01-15 | The method and apparatus for controlling access in a wireless communication system |
Country Status (6)
Country | Link |
---|---|
US (1) | US9900727B2 (en) |
EP (1) | EP2950497B1 (en) |
JP (1) | JP6055111B2 (en) |
KR (1) | KR102145741B1 (en) |
CN (1) | CN104937895B (en) |
WO (1) | WO2014112781A1 (en) |
Families Citing this family (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2013191515A1 (en) * | 2012-06-22 | 2013-12-27 | 엘지전자 주식회사 | Method and device for enabling or disabling server in wireless communication system |
CN111556468B (en) | 2013-05-06 | 2023-02-17 | 康维达无线有限责任公司 | Device triggering |
JP6291573B2 (en) * | 2013-07-02 | 2018-03-14 | コンヴィーダ ワイヤレス, エルエルシー | Mechanisms for the publication and discovery of semantics |
GB2518257A (en) * | 2013-09-13 | 2015-03-18 | Vodafone Ip Licensing Ltd | Methods and systems for operating a secure mobile device |
WO2015110494A1 (en) * | 2014-01-23 | 2015-07-30 | Koninklijke Kpn N.V. | Crash recovery for smart objects |
US10652936B2 (en) * | 2014-03-21 | 2020-05-12 | Nokia Technologies Oy | Short identifiers for device-to-device (D2D) broadcast communications |
US10349248B2 (en) * | 2014-06-02 | 2019-07-09 | Telefonaktiebolaget Lm Ericsson (Publ) | Merging proxy |
US10085211B2 (en) * | 2014-09-02 | 2018-09-25 | Apple Inc. | Communication of processor state information |
GB2529838B (en) * | 2014-09-03 | 2021-06-30 | Advanced Risc Mach Ltd | Bootstrap Mechanism For Endpoint Devices |
KR102048909B1 (en) * | 2014-11-14 | 2019-11-27 | 콘비다 와이어리스, 엘엘씨 | Permission based resource and service discovery |
GB2540989B (en) | 2015-08-03 | 2018-05-30 | Advanced Risc Mach Ltd | Server initiated remote device registration |
GB2540987B (en) | 2015-08-03 | 2020-05-13 | Advanced Risc Mach Ltd | Bootstrapping without transferring private key |
CN110392012B (en) * | 2018-04-17 | 2021-09-14 | 华为技术有限公司 | Method and apparatus for rebooting in lightweight machine-to-machine systems |
JP6724951B2 (en) * | 2018-07-24 | 2020-07-15 | 横河電機株式会社 | Device, method, program and recording medium |
JP6724950B2 (en) * | 2018-07-24 | 2020-07-15 | 横河電機株式会社 | Device, method, program and recording medium |
GB2579571B (en) | 2018-12-03 | 2021-05-12 | Advanced Risc Mach Ltd | Device bootstrapping |
GB2582735B (en) | 2019-02-01 | 2022-11-30 | Arm Ip Ltd | Template-based registration |
GB2580973B (en) * | 2019-02-01 | 2021-12-22 | Advanced Risc Mach Ltd | Message exchange between client and server |
US11475134B2 (en) | 2019-04-10 | 2022-10-18 | Arm Limited | Bootstrapping a device |
KR20210141188A (en) * | 2020-05-15 | 2021-11-23 | 삼성에스디에스 주식회사 | Decentrialized key management system and method |
Citations (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6823338B1 (en) * | 1998-11-19 | 2004-11-23 | International Business Machines Corporation | Method, mechanism and computer program product for processing sparse hierarchical ACL data in a relational database |
CN1553380A (en) * | 2003-05-27 | 2004-12-08 | 鸿富锦精密工业(深圳)有限公司 | Database use authority controlling system and method |
US7082553B1 (en) * | 1997-08-25 | 2006-07-25 | At&T Corp. | Method and system for providing reliability and availability in a distributed component object model (DCOM) object oriented system |
CN1819526A (en) * | 2005-02-11 | 2006-08-16 | 三星电子株式会社 | System and method for user access control to content in a network |
JP2006270353A (en) * | 2005-03-23 | 2006-10-05 | Konica Minolta Business Technologies Inc | Image processor, data management method, and computer program |
CN101080077A (en) * | 2006-05-23 | 2007-11-28 | 华为技术有限公司 | Maintenance method of device management tree and terminal device |
CN101282330A (en) * | 2007-04-04 | 2008-10-08 | 华为技术有限公司 | Method and apparatus for managing network memory access authority, network memory access control method |
CN101316273A (en) * | 2008-05-12 | 2008-12-03 | 华中科技大学 | Distributed safety memory system |
WO2010043175A1 (en) * | 2008-10-14 | 2010-04-22 | 华为技术有限公司 | Method and device for terminal management based on right control |
Family Cites Families (17)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080046433A1 (en) * | 2006-08-16 | 2008-02-21 | Microsoft Corporation | Role template objects for network account lifecycle management |
JP2007193826A (en) * | 2007-02-19 | 2007-08-02 | Ricoh Co Ltd | Data control device, data control and processing method, and computer readable recording medium with program recorded to make computer execute the same method |
JP4131871B2 (en) | 2007-02-23 | 2008-08-13 | 富士通株式会社 | Logic circuit delay optimization system, logic circuit delay optimization method, and program |
CN102546760B (en) * | 2008-02-04 | 2015-11-25 | 华为技术有限公司 | The method of equipment control and terminal, device, system |
CA2730022C (en) | 2008-07-14 | 2017-08-08 | Nokia Siemens Networks Oy | A method and apparatus for a subscriber database |
US8578153B2 (en) * | 2008-10-28 | 2013-11-05 | Telefonaktiebolaget L M Ericsson (Publ) | Method and arrangement for provisioning and managing a device |
US9590961B2 (en) * | 2009-07-14 | 2017-03-07 | Alcatel Lucent | Automated security provisioning protocol for wide area network communication devices in open device environment |
US8116757B2 (en) | 2009-07-29 | 2012-02-14 | Intel Corporation | Virtual network service provider for mobile virtual network operator activation |
US8924544B2 (en) * | 2010-12-07 | 2014-12-30 | Samsung Electronics Co., Ltd. | Techniques for sessionless reporting by device management client |
WO2012124999A2 (en) | 2011-03-17 | 2012-09-20 | 엘지전자 주식회사 | Method for providing resources by a terminal, and method for acquiring resources by a server |
US8516607B2 (en) * | 2011-05-23 | 2013-08-20 | Qualcomm Incorporated | Facilitating data access control in peer-to-peer overlay networks |
EP3425942A1 (en) * | 2012-01-13 | 2019-01-09 | Iot Holdings, Inc. | Method and apparatus for supporting machine-to-machine communications |
WO2013191515A1 (en) * | 2012-06-22 | 2013-12-27 | 엘지전자 주식회사 | Method and device for enabling or disabling server in wireless communication system |
US9571502B2 (en) * | 2012-09-14 | 2017-02-14 | International Business Machines Corporation | Priority resolution for access control list policies in a networking device |
KR102245367B1 (en) * | 2012-10-30 | 2021-04-28 | 엘지전자 주식회사 | Method and apparatus for authenticating access authority for specific resource in wireless communication system |
WO2014069968A1 (en) * | 2012-11-05 | 2014-05-08 | 엘지전자 주식회사 | Method and apparatus for updating information regarding specific resource in wireless communication system |
US9615346B2 (en) * | 2012-12-05 | 2017-04-04 | Lg Electronics Inc. | Method and apparatus for notifying information change in wireless communication system |
-
2014
- 2014-01-15 JP JP2015551628A patent/JP6055111B2/en active Active
- 2014-01-15 EP EP14740172.3A patent/EP2950497B1/en active Active
- 2014-01-15 WO PCT/KR2014/000425 patent/WO2014112781A1/en active Application Filing
- 2014-01-15 KR KR1020157015601A patent/KR102145741B1/en active IP Right Grant
- 2014-01-15 US US14/760,105 patent/US9900727B2/en active Active
- 2014-01-15 CN CN201480005392.9A patent/CN104937895B/en active Active
Patent Citations (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7082553B1 (en) * | 1997-08-25 | 2006-07-25 | At&T Corp. | Method and system for providing reliability and availability in a distributed component object model (DCOM) object oriented system |
US6823338B1 (en) * | 1998-11-19 | 2004-11-23 | International Business Machines Corporation | Method, mechanism and computer program product for processing sparse hierarchical ACL data in a relational database |
CN1553380A (en) * | 2003-05-27 | 2004-12-08 | 鸿富锦精密工业(深圳)有限公司 | Database use authority controlling system and method |
CN1819526A (en) * | 2005-02-11 | 2006-08-16 | 三星电子株式会社 | System and method for user access control to content in a network |
JP2006270353A (en) * | 2005-03-23 | 2006-10-05 | Konica Minolta Business Technologies Inc | Image processor, data management method, and computer program |
CN101080077A (en) * | 2006-05-23 | 2007-11-28 | 华为技术有限公司 | Maintenance method of device management tree and terminal device |
CN101282330A (en) * | 2007-04-04 | 2008-10-08 | 华为技术有限公司 | Method and apparatus for managing network memory access authority, network memory access control method |
CN101316273A (en) * | 2008-05-12 | 2008-12-03 | 华中科技大学 | Distributed safety memory system |
WO2010043175A1 (en) * | 2008-10-14 | 2010-04-22 | 华为技术有限公司 | Method and device for terminal management based on right control |
Also Published As
Publication number | Publication date |
---|---|
CN104937895A (en) | 2015-09-23 |
WO2014112781A1 (en) | 2014-07-24 |
KR102145741B1 (en) | 2020-08-19 |
JP2016507823A (en) | 2016-03-10 |
EP2950497A4 (en) | 2016-10-12 |
EP2950497B1 (en) | 2018-03-07 |
KR20150107720A (en) | 2015-09-23 |
US9900727B2 (en) | 2018-02-20 |
JP6055111B2 (en) | 2016-12-27 |
EP2950497A1 (en) | 2015-12-02 |
US20150358824A1 (en) | 2015-12-10 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN104937895B (en) | The method and apparatus for controlling access in a wireless communication system | |
US11977659B2 (en) | Data anonymization for service subscriber's privacy | |
CN104838618B (en) | The method and apparatus of authentication-access authorization in a wireless communication system | |
CN109997114B (en) | Service layer resource management for universal interworking and extensibility | |
CN104303454B (en) | Method of the certification to the access mandate of the specific resources in wireless communication system | |
EP3811639A1 (en) | Automated iot device configuration using user profile | |
WO2014069968A1 (en) | Method and apparatus for updating information regarding specific resource in wireless communication system | |
CN112236990A (en) | Service layer based method for enabling efficient analysis of IOT data | |
CN111095904B (en) | Service layer message template in a communication network | |
US20200220919A1 (en) | Overlay resource trees in a communication network | |
CN107211236B (en) | Resource link management equipment and method for service layer | |
CN111542001B (en) | Network system with distributed server clusters and construction method thereof | |
KR20210102063A (en) | Method and apparatus for performing confirmed-based operation in machine to machine system |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
C10 | Entry into substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant |